laravel query builder always returns ? instead of value of variable

Question

I am using laravel 7.7.1 and in a query I pass a variable iaw the docs like so:

public function show($graad=3)
    {
        $sums=Sum::where(function ($query) use($graad) { 
            $query->where('graad',$graad);
            })->inRandomOrder()->limit(1)->toSql();

Result is always:

"select * from `sums` where (`graad` = ?) order by RAND() limit 1"

So the variable is not passed in the correct way and converted to a "?".

Changing the value of $graad='test' or $graad='3' or even typehinting with

 public function show(int $graad=3)

does result in

 "select * from `sums` where (`graad` = ?) order by RAND() limit 1"

The column graad in the table is an int(11). What am I doing wrong?

Neither you nor the ORM are doing anything wrong. What you see is the expected result of the `toSql()` function. Please read all of [this](https://phptherightway.com/) before picking up a framework. — kalatabe, May 06 '20 at 05:50
This is returning query instance. When you will pass the parameters, it will replace them in the place of ```?``` and execute on ```->get()``` function call. — S K R, May 06 '20 at 06:24

jeremykenedy · Answer 1 · 2020-05-06T06:07:23.813

0

I think you are missing the get()

try:

$sums = Sum::where('graad', $graad)->inRandomOrder()->limit(1)->get();

or

$sums = JOBS::where(function($query) use ($graad){        
    $query->where('graad', $graad);
})->inRandomOrder()->limit(1)->get();

public function show($graad)
{
   // Rest of your code

And then make sure your route is receiving the value in the url and sending along (Assuming this is how you are calling the method).

Route::get('your-route-name/{graad}', 'YourController@show');

edited May 06 '20 at 06:07

answered May 06 '20 at 05:42

jeremykenedy

4,150
1
17
25

That's not asked. – S K R May 06 '20 at 06:25

score 0 · Answer 2 · answered May 06 '20 at 06:26

Laravel under the hood uses Prepared Statements. This is to avoid SQL injection. The ? is the placeholder for the data that will be substituted later by the bindings.

You can use $query->getBindings(); to fetch the data that will be binded in SQL statement.

tesmojones · Answer 3 · 2020-05-06T06:06:48.940

-1

Please try this below:

public function show($graad=3)
    {
        $sums=Sum::where(function ($query) use($graad) { 
            $query->where('graad',$graad);
            })->inRandomOrder()->limit(1);
        vsprintf(str_replace(['?'], ['\'%s\''], $sums->toSql()), $sums->getBindings());

edited May 06 '20 at 06:06

answered May 06 '20 at 05:44

tesmojones

2,496
2
21
40

Please don't teach people to perform SQL injections on themselves. – kalatabe May 06 '20 at 05:50
character "?" is placeholder for binding value of $graad, it is normal output and can not be changed. for complete explanation or solution for debugging, please refer to https://stackoverflow.com/questions/32372437/does-laravels-tosql-method-mask-ids-column-value-being-replaced-by-question – tesmojones May 06 '20 at 06:02
the answer of tesmojones was for me the right answer. Thanks all! – Erikkie May 06 '20 at 07:14

laravel query builder always returns ? instead of value of variable

3 Answers3